7747b0d65cd80d7c31c52db2e9f4a6f953aad7602fb4f5745c401df68358f6c2 | Triage

Sharing

General

Target

7747b0d65cd80d7c31c52db2e9f4a6f953aad7602fb4f5745c401df68358f6c2
Size

1.8MB
Sample

220925-zwtngshdaj
MD5

a9e7d1dbd918dacbc8f3f20be56b9c17
SHA1

dda8196c27e26c363f10f1e695770f689b59292a
SHA256

7747b0d65cd80d7c31c52db2e9f4a6f953aad7602fb4f5745c401df68358f6c2
SHA512

1503140882142e9bdd57df8ecaa47f2c388268cd47dd083cf7cd357d13130dd5bda773883b32cdf3f3fbeb36f174a676d1fc1ffa0139b4d45d8910152c33e636
SSDEEP

49152:AiSzCD+K95aLs7zeqLTVtXtHFIDP8EehiM8qZA:AiSzCD+K95aUeqFtXtHwEEehig

Score

9^/10

evasion trojan

Malware Config

Targets

- Target
  
  7747b0d65cd80d7c31c52db2e9f4a6f953aad7602fb4f5745c401df68358f6c2
- Size
  
  1.8MB
- MD5
  
  a9e7d1dbd918dacbc8f3f20be56b9c17
- SHA1
  
  dda8196c27e26c363f10f1e695770f689b59292a
- SHA256
  
  7747b0d65cd80d7c31c52db2e9f4a6f953aad7602fb4f5745c401df68358f6c2
- SHA512
  
  1503140882142e9bdd57df8ecaa47f2c388268cd47dd083cf7cd357d13130dd5bda773883b32cdf3f3fbeb36f174a676d1fc1ffa0139b4d45d8910152c33e636
- SSDEEP
  
  49152:AiSzCD+K95aLs7zeqLTVtXtHFIDP8EehiM8qZA:AiSzCD+K95aUeqFtXtHwEEehig
Score

9^/10

evasion trojan
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Executes dropped EXE
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1